EP208 The Modern CISO: Balancing Risk, Innovation, and Business Strategy (And Where is Cloud?)

Secure running.

Hi there. Welcome to the Cloud Security Podcast by Google. Thanks for joining us today. Your hosts here, as ever, are myself, Tim Peacock, the Senior PM for Risk Analytics and Cloud Threat in Google SecOps, and Anton Chuvakin, a reformed analyst and senior staff in Google Cloud's Office of the CISO. You can find and subscribe to this podcast wherever you get your podcasts. as well as at our website, cloud.google.com/podcasts. If you enjoy our content and want it delivered to you piping hot every Monday, please do hit that subscribe button. You can follow the show, argue with us and the rest of the CloudSec Podcast listeners on our community page. Anton, we are doing one more really fun episode today, talking with a CISO at a forum. And this is a fun one because we get to talk about what long-term means.

I think that the— by the way, I need to— we may need to correct the opener because I was on another podcast a few weeks ago and somebody said that I only qualify as a reforming analyst and not as reformed. I'm not quite sure what to do with it at this point.

Oh, like you're not fully yet committed to your new life.

I was told in December 2024 that I am still reforming and I'm not fully reformed. Again, this may be a minor point, but it sounds like a fun way to start the discussion.

I haven't seen any slides from you with horrible overlapping circles lately, so I don't know. I feel like you've come a long way.

I have not made a quadrant for many, many years. So, I think that they're mostly deformed. So, well, I guess we'll stick to our version. As far as seesaws, this is probably the best way that you would see in the show questions is that what we thought before when we planned this episode was how to be forward-looking and strategic, yet not veer into dreaming paranoia and imaginary risk. This is the kind of theme and the inspiration for this. You can say, oh my God, in 2030, this horrible thing would happen to our company. But it is very easy to slide into dreaming and paranoia. But if you only focus on what's going to happen tonight or tomorrow morning, then you lose the strategic element. And my sense was that it's actually genuinely tricky.

So I think that's fascinating. And I love listeners that you get a little peek behind how our podcast works. It is true that no script survives first contact with the guest.

Yes.

To misquote Helmut von Moltke. So, maybe with a diversion into strategy, listeners, let's turn things over to today's guest.

Hi, everyone. We have the privilege of being joined today by John Rogers, the CISO of MSCI. So, John, welcome. It's great to see you. And you have had a very varied and interesting career path with extensive background in cybersecurity and in financial services. So, can you briefly walk us through a little bit of what you've done throughout your career up to this point?

Sure. Most of it's been in the financial services sector. I started my career at Bank of America as a Unix and Linux security engineer. I made my way into a variety of different consulting roles. I worked for 3 different consulting firms, so I got a lot of really nice experience throughout the industry from that exposure. And then I, I was given an opportunity to be the America CISO for BNP Paribas, the French bank, and then I've migrated my way to MSCI. So now I'm in charge of both cybersecurity, privacy, resilience, IT change management, a number of other sort of, you know, kind of add-on type areas in addition to security. But thanks for having me.

Sure.

It'll be fun. And I think that we have some of the really softball questions. And I think that almost softball bordering on cliché is asking a security leader about the trends. But ultimately, we want to get to this discussion of long-term, short-term thinking. While I do want to ask you about the trend, whether it's for cloud security or in general, but like, if you're telling something about the trend, give us the timeframe for that trend. Is it something that's been— you expect to happen in years, or is it something that's happening now? So what are your favorite trends in security?

Yeah, I think you're probably leading me to say AI, but I'm going to try not to talk about AI because I know a lot of your other podcasts—

You're going to be the first to say AI.

Aha.

So we didn't make you to say AI by not making you say AI.

It's like bingo, right? Well, and look, AI is a huge topic these days, and there are, you know, implications for AI with advanced phishing threats that we're seeing today, you know, deepfakes. There's a lot of AI-related things. I just think that you've covered it so much in your other podcasts, we can skip it for today. The 2 that I think I wanted to mention that I think deserve more attention in the short term than perhaps the long term are the movement away from sort of compliance security. And by that, I mean like the frameworks like NIST and ISO, which are important, but to me are are sort of the baseline sorts of controls that you should implement and moving strategically away from those sorts of control frameworks into more attack simulation type strategies. So using, for example, the MITRE ATT&CK framework. I know Google has their own sort of version of MITRE ATT&CK, but the vast majority of people in the security industry are using MITRE ATT&CK and MITRE Defend these days to do red-purple team tests, you know, and basically just test the resilience and security of their, of their controls. I think that's the future, right? To me, it's less about testing whether there's a feed that can disable an employee's access when they're terminated from the company and much more about can you repel or at least detect a particular attack technique that's associated with your, you know, the threats that you face as a company. And you see a little bit of this happening already in the industry. So in the EU, the new DORA legislation that's actually, I believe, going live in January is actually, you know, it has a huge component of threat-led penetration testing, which is what I call red and purple team testing. And to me, that's sort of leading down that path where attack simulation becomes the strategies of a lot of companies going forward. And to me, when you do an attack simulation, you're testing, you know, a multitude of your controls altogether, not just one bespoke control at a time. There's a place for all of that, right? You need to do bespoke testing of each particular control. So I'm not advocating that we stop using NIST and ISO and these other frameworks. I just think we need to blend it a little bit better and have our strategy, you know, be more more inclined in that direction. So, that's the first one. The second one is actually what I call true cyber resilience.

Resilience does come up, and I think it's almost like that's the other bingo game. You said AI, but you also said resilience first.

But I think people do it wrong. That's the big problem, right?

Or they just equate it with cybersecurity, which is even more wrong.

Or they just equate it to disaster recovery generally, right? So, they assume that if you have your workloads in 2 different cloud regions, for example, that you're cyber secure against, you know, a malware attack. And that's just not the case. We know that the threat actors are much more sophisticated than that. They're not, you know, our resilience strategies with typical DR are focused on, you know, hardware outages and power issues and things like this and geographic, you know, weather issues. It's not cyberattacks. And I think, you know, Phil Venables talks about this in some of his talks, but the notion of being able to reboot your company from scratch is a really important fundamental concept that a lot of companies are just not doing yet and need to be doing. And it's really hard, right? We've been doing it at MSCI. This is our 4th year, 4th generation of our cyber disaster recovery capability, and we're still not where we want to be yet. The idea is you start small, right? You start with the most critical, critical things in your business, the stuff that absolutely cannot go wrong and must stay up and running. Even if you have a significant, you know, material cyber attack like ransomware that affects your operational readiness, you need to be able to reboot and rebuild those services from scratch in a very short time period. A lot of companies still pay ransoms not because they don't have access to the data, right? The data may be encrypted, but they have some offline backup copy somewhere. The reason that they pay the ransom still is because they can't get the compute back up and running fast enough. And gosh, we have this cloud infrastructure where it's rapidly scalable. Why not use it? You know, to me, that's a fundamental thing that the industry— again, while some regulators talk a lot about cyber resilience, They're not talking about it in the concept of sort of rebooting from scratch. And by the way, doing it, it's so hard because you need to really fundamentally know how your services work from a technical perspective and how they map all of the dependencies. And a lot of companies don't have that true visibility to be able to do this properly. And so, they struggle finding where the barriers are between what's critical and maybe just high.

And they also have, or they know 90%, but the 10% is kind of a critical piece in some other process. I think that our Mendiant colleagues often tell the story about how somebody had everything planned out, but everything was relying on AD, and AD is what got encrypted. So in essence, everything else would have worked perfectly if not for this one thing. I mean, it's sort of an obvious example, but yeah.

But it's the perfect example, right? So a lot of times when you do red and purple team testing, what it points out is that the disaster recovery environment, even if it is, you know, somewhat isolated, oftentimes still depends on the same AD. And so therefore, if you can compromise AD or compromise domain admin credentials within AD, you can pivot into that DR environment, and then, you know, game over. That's why you need to have a separate authentication realm for your disaster recovery environment.

Interesting. I have to say, I really love the direction that this conversation's taking, and I love that you have a very sort of comprehensive and forward-looking view in terms of cybersecurity and resilience. And I think emerging tech is going to, like, fit quite nicely within that, as well. But kind of picking on that thread a little bit, what I wanted to ask was, how do you balance sort of the everyday problems, the today problems, the imminent threats, the ones that you know are real threats that obviously need to be detected and mitigated, versus the emerging threats that may be clear, may not be, but you also kind of need to have that sort of strategic view of what's, what's on the horizon? and take steps today. So, to your point about, for instance, the BCDR planning, a lot of that planning has to anticipate these various threats and take steps now to be prepared a year from now, 2 years from now. How do you manage that in the day-to-day, this sort of very imminent tactical approach versus the strategic?

I think you have to pay attention to geopolitics to a degree. I mean, a lot of the things that we've been doing tabletops on, you know, potential invasions of Taiwan, these sorts of things, advances in quantum computing that sort of dictate what the potential future may be. I think if you ask most CISOs, the biggest concern they have right now is ransomware, right? The biggest threat they see. And, you know, unless you work in the, uh, you know, for a company in the defense sector or, you know, a national utility, critical infrastructure, you know, or if you have like Google, you know, massive amounts of PII, I don't think you're a huge target of nation-state threat actors, right? So I think to me, the security industry has kind of maybe done a disservice and maybe done a little bit too much scare tactic type work, giving out all these threat intelligence reports And, you know, while it's important to keep an eye on those sorts of things, you do have to kind of relate it back to your own business and focus on that because you can certainly get distracted by what might happen in the future, right? The idea in security is to stay 1 or 2 steps ahead, not 30 steps ahead, right? So we could talk about, you know, what AI can do, you know, where AI may be in 10 years, in 5 years, the implications of post-quantum computing, which, you know, is probably a 2035 problem, although we've been saying it's a decade away for, you know, 10 years. 20 years now, so I'm not sure.

Optimistic view.

Right.

I mean, it's for some disasters. If it's 10 years away every time, then it's sort of an optimistic view, right?

That's true.

That's true.

But yeah, look, I think you have to keep an eye on how things are changing in the industry for sure, right? And part of your threat intelligence, part of your strategy needs to be thoughtful about trying to stay one step ahead. But I do think most security teams at the moment are struggling to even stay where they want to be now, right? You know, the biggest issue that we have in security is the prioritization problem.

The what?

The prioritization problem.

Prioritization, yes, yes, of course.

Because we have so many issues that are in our environments, whether it's a CVE, whether it's a misconfiguration, what have you. I think we struggle to allocate resources in the right ways to be able to most effectively reduce risk to our companies. And also, I think, you know, security teams have been kind of ballooning in size over the years, Whereas the people who are actually fixing the security problems are oftentimes developers, right? So, a lot of the time I've been spending has been focused on how do we interact better with the development teams? How do we, you know, help them to automate away some of the problems that cause security issues, you know, sort of address the root cause of the problem rather than sort of the, you know, hey, there's a million things that you have to focus on. We'll give you 500,000 to fix. You know, we'll prioritize 500,000 for you instead of a million, right? That's just It doesn't scale particularly well.

But isn't prioritizing literally— sorry for going off the script here, but isn't prioritizing what to do literally the job of a security leader? Like, if you say we struggle with prioritization, prioritization is the job, everything else is kind of secondary to that, isn't it a bit depressing?

It's very depressing.

Oh, it's very depressing.

It's not just a bit depressing, it's very depressing.

This is why we don't sleep well. No, I mean, look, there's lots of different constraints on us, right? We have regulatory obligations, we have internal and external auditors, we have clients that also kind of try to influence our strategy. And in many ways, especially bigger companies, they struggle with technical debt. And, you know, they really struggle with how to prioritize most effectively given all of these various constraints, not just because of the budget issues. This is part of the reason why I joined a smaller sort of company. is to be able to wrap my hands around these problems and be able to solve them a little bit more effectively. And I'm very proud of the work that we've done, obviously.

I think you've done a lot of really interesting work. And so, I'm curious in terms of, like, you mentioned budgets, right? And you mentioned having to navigate relationships with various stakeholders. And so, I think one of the major stakeholders from an influence perspective that you need to engage with is your board. And a lot of that obviously ties into being able to get budget for the initiatives that you feel need to be prioritized. Do you have any sort of advice or lessons learned in terms of how to be effective in that communication? Because I hear that a lot from CISOs that we speak to, where it seems to be sort of a need to be able to speak a slightly different language, right, to make the sometimes very technical issues relevant to the board by tying them into the true business risk that they pose. And so, from the interactions that you've had throughout your career when it comes to boards, any lessons learned in terms of how to navigate those discussions and be effective in getting what you need so that you can manage both the tactical and the strategic priorities?

I think a lot of it comes down to storytelling, right? There's a cliché that you have to be, you know, that you have to talk in the context of the business to be successful with senior business people. I think that's a little patronizing because a lot of them actually do understand technical topics, and a lot of them come from You know, IT backgrounds, and even some of them nowadays have actually been trained on cybersecurity and have a much better knowledge than say 20 years ago. So, you know, I try and find a balance to this sort of conversation. I think one, you need to be on the same page about what the threats are, right? What are the things that can go wrong with the business? You know, when you first start as a CISO, you have to interview the business people across the board as well as the board members to understand their view on what can go wrong from a cybersecurity perspective. And then you sort of, you know, influence based on your own experience that type of conversation, but you then can talk about it in a business context, right? What would happen if XYZ part of our business was unavailable because of a ransomware attack? What would you do in that situation? So I think that's part of it. I do think that, you know, you need to be able to talk about progress, right? Because you, you're meeting with them, you know, most of the times you're meeting with the full board or a subcommittee of the full board at least quarterly. So you need to have a metric. And a lot of people have used the NIST Cybersecurity Score as well as some additional metrics like incidents and things like that. to engage with the board and be able to show progress over time. I think that's really important, and that's served a huge purpose just in terms of being able to demonstrate progress. And, you know, to the earlier point I made about the MITRE ATT&CK framework, I don't think putting the entire MITRE ATT&CK framework on a board slide is the right answer either, right? But you can talk about these things in stories, right? You can say we did a, a red team exercise and simulated an attack from a sophisticated nation-state attacker threat group, and we tested you know, 10 to 20 different ATT&CK techniques that we're most concerned about. And here are the results, right? We did well, we did not do well. And you don't have to give all of the nitty-gritty details about, you know, we were able to detect the lateral movement. You know, the board members don't care about that detail.

Yeah.

But they do want to see progress over time. And especially if you can benchmark against your peers, right? A lot of the questions I get asked at the board meetings is about, you know, how well are we doing compared to our peers, right? We like to think that we're on the high end of the average. in terms of our maturity, but is that in fact true? So, you really do need to have an opportunity to benchmark yourself against peers. That's what consultants are helpful for. That's why, you know, having peer discussions, inviting, you know, other companies to come and speak to your board on occasion is also very helpful to give them that broader exposure and why it's important for CISOs to, you know, to spend time outside of their own companies as well.

Yeah.

By the way, as a quick— I'm going to connect to one side point you made about better part of average because I've met enough people who, you know, back in my Gartner days, who want to benchmark somewhat above average, but who don't want to be great. Is that related, or am I reading too much into this point?

I mean, I think the real answer is you have to be good at the things that you're most concerned about, right?

But good or best or great?

It depends on your appetite, right? So, you know, this concept of risk appetite, you know, 10 years ago, if you asked a board member what the risk appetite for cyberattacks was, they would always say zero. Oh, zero.

Okay.

Yeah, we have zero appetite for cyber risk, right? It's absolutely critical that we solve this cyber problem, and they have no notion of how to actually do that, but, you know, just fix it for us. And even with unlimited budgets, that's impractical, right? So, and impossible.

The question I have kind of to further down that path is we did talk about longer-term risks and shorter-term, and I think you wisely pointed out that many CISOs, for them, longer-term is maybe the end of the week, if not the end of the day. If there's a way to sort of balance this and still consider longer term without being sort of paranoid and futuristic. So is there any kind of a magic trick or a way to balance the long term with short term? Sometimes I describe it as kind of a 3 AM answer. If somebody wakes me up at 3 AM and says, Anton, how do you do X and Y? So, in this case, is there anything simple? I mean, I think your answer was like, you need to balance. And of course, I agree with it. But is there any mechanism or a trick to this that people can use?

Maybe there's no trick.

Maybe the answer is—

Well, but just a clarification question. So, when you say a trick, help me understand a little bit more what you're looking for.

So, what I mean is if you have to make a decision, prioritize, as you pointed out, about something that's maybe realistically scary yet relatively long-term versus something that's maybe a little less scary but probably more imminent? What would be the pros and cons for deciding to spend money on the former rather than the latter or the opposite? I think that for some people, short-term always wins. I get that. But if you want to be balanced, what's the way to be balanced?

Got it. So I think you use threat intelligence to help prioritize, right? A lot of people use threat intelligence very Tactically, right? You know, there's a, an IOC, which I don't think actually is intelligence, to be fair.

Mm-hmm.

But a lot of people, you know, misconstrue those. I think you use threat intelligence to help define your strategy for, you know, the next year, the next 3 years, as well as the next 3 weeks. And we set a specific target at MSCI for MITRE ATT&CK techniques that we want to prioritize based on the threats that we are facing, and we work You know, in projects associated with the detection and defense improvements against those particular MITRE ATT&CK techniques. So that's kind of how we think strategically as well as tactically about the work that we're doing. Things that are not necessarily ATT&CK, directly ATT&CK related, things like the geopolitical implications of a Taiwan invasion or a blockade, the post-quantum computing sort of conversations, to me, those things We do tabletops to discuss amongst a group of stakeholders internally, mostly about where we feel we are against those particular risks and what the— is this a 2025 problem? Is this a 2030 problem? Is this a 2035 problem? And then you can prioritize based on your level of expectation of when that threat might be or that risk might be realized, right? I think that's the way to think about this. You can use tabletops as a way— you could just have meetings to discuss these topics.

Yeah.

our heads in the sand about potential risks. At the same time, you can get seriously distracted thinking about 30 steps ahead than when you have something directly in front of you that you know there's a particular vulnerability that these attackers are using, and this attacker is in your top 10 attackers concern list. You want to focus on that in the short term and the medium term.

So to me, I hear mostly that if you— the trick, so to say, is just to do a good job leading security. It sounds like it's kind of like if you're a good security leader, you sort of know how to do it. And if you're not, then you don't. There's no trick. There's conclusions to be drawn here.

I don't want to give away my secrets either, right? I mean—

Yeah, OK, good. No, but it's very fair that it may be— it's not like you just unveil this one thing you need to know, and that's like you push the button and it's decided. But I think that logic does make sense. And tabletops, to me, is a really kind of critical piece of that, it sounds like.

It is. I mean, we do a lot of tabletops throughout the year, right? And we do some of them that I think the discussions are, are not particularly helpful, right? And, and we do some that are, are so helpful and so impactful that we decide to do a lot more, and we repeat a lot of them as well. So I think, I think it is important to have that type of discussion and, you know, know who the various stakeholders are, right? Post-quantum cryptography— have you even got an inventory of where all of the crypto libraries are that you're using across the firm? And how quickly could you produce that inventory, let alone swap out the crypto for, you know, some post-quantum algorithm. That, I think, is something that, because it takes so long to actually fix, you need to plan well in advance. And, you know, hopefully it takes 10 years for, you know, these advances to happen in the quantum computing space, because it'll give us time to prepare. But a lot of companies are not anywhere with this problem.

And then to note, given that we have limited time, I don't want to push too much on the post-quantum, but it came up in some dinner conversations yesterday. And it's interesting that this problem that may have a unique feature that there's no way to run it on turbo when it's urgent. There's no way to, well, now it's a priority. Let's get it done in 2 weeks. There's no amount of money and resources and human power that would make you go faster. So, it's almost like it has to be done as a long-term problem. It cannot be run on turbo when it's needed.

Well, I mean, we have zero-day vulnerabilities that pop up all the time, right? So, that's turning on turbo every single day.

That can be done.

Maybe smaller scale, right? But you have to think about the risk associated with your business too, right? If you're not dealing with huge datasets, right? If you're not dealing with personally identifiable information, the risks associated with post-quantum computing and the harvest now, decrypt later sort of issue, I don't think most companies actually have to worry about this. I think it is something that if there is a major advance that happens tomorrow, let's say, you know, everybody would start these projects immediately, but I don't think there's an imminent sort of risk to 99% of the companies out there, right? So we have to be thoughtful about planning, but again, we don't want to overcorrect either and, and think that the risk is so bad for us in this particular situation. The biggest issue in security that we have right now is not thinking about the future. It's that we're 10 years behind.

Yeah.

Right? Every company, when I was consulting, I would ask the CISO, how many CVEs do you have, you know, associated with your infrastructure or your, your software? And most of the big companies, it was in the millions, hundreds of thousands, right? And of course, you know, there's layers to that, right? Critical vulnerabilities are far fewer. And, you know, of course, there's various different, you know, toxic characteristics of multiple vulnerabilities and multiple misconfigurations that make things worse, that sort of makes it a smaller subset of problems that you have to actually focus on. But every company has these sorts of challenges right now, and they are behind. that's the biggest issue in security. We're not solving a lot of the root causes of these issues in a way that scales effectively. It would be fine if the only CVEs I had to worry about or the only risks I had to worry about were post-quantum cryptography and zero-day vulnerabilities.

Yes.

But in fact, I've got old Java, I've got, you know, all old versions of, uh, you know, operating systems in some parts of our business. And we've made thoughtful decisions to accept risks in certain areas because we just don't have the resources to prioritize everything. And we wanna make sure that the stuff that's that's client-facing, that's internet-exposed, that is more risky, that that is cleaned. And, you know, we can accept some risks in other areas as a way to do that prioritization. But I do think a lot of— I'll say one more thing. A lot of security people and a lot of security vendors particularly have spent an awful lot of money building products that help us do this analysis.

Mm-hmm.

And we are suffering from analysis paralysis. Rather than trying to debate the business value of a particular server, or the implications of a particular vulnerability. Please, we must solve the root causes of these issues, meaning that software developers have to write more secure code. They have to be able to deploy the updates faster, and they need test automation coverage, automated test coverage to be able to do that. That's really the fundamental thing that's causing a lot of the security vulnerabilities in my view. And, you know, GenAI tools being able to create new unit tests and different types of QA automation for us, That will go a long way to drastically reducing the total number of vulnerabilities if we can get behind it. Same thing with infrastructure. When we talk about modern architectures like Kubernetes and cloud, we have such an opportunity to eliminate large numbers of vulnerabilities when we move into these environments and when we migrate. This is the promise of cloud. This is the promise of, you know, modern architecture. This is why I'm such a huge proponent of security and, and moving it to cloud.

I love that. So, I think, unfortunately, very unfortunately, by the way, we are coming up on time. So, we have a final question for you. And this is like, we call this the magic wand question. So, if you could wave your magic wand and get anything you want from a security perspective, what would it be?

Please don't say faster patching.

Wow.

No one's ever asked me this question.

I'm sorry for spoiling it.

I think having GenAI be able to help us significantly address code-related security vulnerabilities in a meaningful way would go a long way to addressing security. We've been really fortunate as an industry that certain controls that a lot of companies have implemented, EDR, MFA, have really succeeded at defending and preventing attacks, right?

Mm-hmm.

I feel like we have turned a corner in the security community. That's not to say that there will not continue to be lots of breaches and ransomware and these sort of other threats will continue to happen. But I'm short-term pessimistic, long-term optimistic, because we are making such progress in a lot of areas. And I think that there's much better awareness now with AI and just generally an understanding of what the problems are and how to solve them, that I think the future is going to be much brighter. Now, of course, we can talk about You know, what could happen when the AIs are fighting the AIs and, you know, your company, your security team is just the AI. I'm not thinking 30 steps ahead yet, but I do see a very positive future for us.

That's probably eventually a podcast, but hopefully not next year. So, any resources you'd recommend for people to get better at this? And sorry for sort of ambushing you with the resources question, but any recommended reading, any recommended resources?

To me, the MITRE ATT&CK framework is the most important thing. If you're a CISO or if you're in a security team, you need to understand the MITRE ATT&CK framework in and out. And you need to understand how your company is doing against the MITRE ATT&CK framework because that truly is the best way to test your defenses and your detection capabilities against cyberattacks. That's the number one that I would recommend.

And I think the D3FEND that you brought up before is kind of a hidden gem. So far, I've met very few people who know about D3FEND. And when I spoke with the crew, it turns out that it's kind of seen as a very emergent thing that people love and almost nobody knows. So, by the way, D3FEND is spelled with a 3. So, this is kind of a cool thing to discuss maybe next year.

Yeah.

I mean, it's a shame that it's not more well-known, right? I mean, to me, when you're designing controls to improve your attack simulation defenses, you use D3FEND because they're all mapped to each other. But to me, you can use any framework, right? There's the CIS benchmarks, there's NIST, there's all sorts of control frameworks that you can use to properly defend. But you need to understand the threat landscape and the way that the attacks happen and be able to detect and prevent those from that angle as well. To me, that's the critical piece.

Perfect. That's a good way to close the show. And thank you very much for being on the podcast.

Thanks for having me.

And now we are at time. Thank you very much for listening and, of course, for subscribing. You can find this podcast at Google Podcasts, Apple Podcasts, Spotify, or wherever else you get your podcasts. Also, you can find us at our website, cloud.withgoogle.com/cloudsecurity/podcast. Please subscribe so that you don't miss episodes. You can follow us on Twitter, twitter.com/cloudsecpodcast. Your hosts are also on Twitter, @anton_chuvakin and @_timpeagle. Tweet at us, email us, argue with us, and if you like or hate what we hear, we can invite you to the next episode. See you on the next Cloud Security Podcast episode.

Bye.

Security.

Security.